Hi everyone. Looking for some real-world advice from folks who've managed these tools.
We're a finance company with about 500 users, all on-prem for now. My team is small, and I'm the one who ends up managing our logging/SIEM setup in my spare time. We've outgrown our old open-source stack (Graylog) and need proper security reporting and compliance.
The shortlist is down to Exabeam and Splunk Enterprise Security. I've read the spec sheets, but I'm worried about the day-to-day for a team like ours.
* How steep is the learning curve for each? I'm comfortable with Linux and basic queries, but not a full-time security analyst.
* What's the actual operational overhead like? I've heard Splunk can become a full-time job just to keep it tuned.
* For a 500-user scale, is the pricing difference as dramatic as it seems? We're cost-conscious but can't afford major blind spots.
Any gotchas or things you wish you'd known before deploying either in a regulated environment would be super helpful. Thanks.